modiloader | 5fb712bf3dbf2945f7b4a4e53648ccd12b7ec54258dd0c8c84c3400eeb282aae

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 13:44

Target

eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe
Size

27KB
MD5

eb33251c5bb482504bd24560d5277695
SHA1

b3aab57a661e23b67e9c663e240dd34643f7bd57
SHA256

5fb712bf3dbf2945f7b4a4e53648ccd12b7ec54258dd0c8c84c3400eeb282aae
SHA512

c43f280e3069505f63ab095c8699c776d9c581c5713a2aa8a65a3cbc372da7c9c9f9e2854206c697cd3f1b464143a3e74d8f2a0f5de94afd0f8d79905a822c1c
SSDEEP

384:8KoA0iaVZAszu/RQ+mLyvXYu5+z0Y5cQcEX2FHoM0K3qND0MEuq2NE9mvnTDJ5eO:7oTHupC2/kB5cWmFIM050MBq2yIDJcO

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/memory/2876-14-0x0000000000400000-0x0000000000425000-memory.dmp	modiloader_stage2
behavioral1/memory/3032-13-0x0000000000400000-0x0000000000425000-memory.dmp	modiloader_stage2
behavioral1/memory/2876-16-0x00000000002A0000-0x00000000002C5000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
3032	ow.exe

Loads dropped DLL 2 IoCs

pid	Process
2876	eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe
2876	eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3032	2876	eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe	28
PID 2876 wrote to memory of 3032	2876	eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe	28
PID 2876 wrote to memory of 3032	2876	eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe	28
PID 2876 wrote to memory of 3032	2876	eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876
- C:\RECYCLER\ow.exe
  C:\RECYCLER\ow.exe
  2⤵
  - Executes dropped EXE
  PID:3032

C:\RECYCLER\ow.dll

Filesize
32KB

MD5
749f5c8ea788fc4aa90c92cad5c2c026

SHA1
5cbd1b3178a1681296bae548bc52ece8256df1da

SHA256
b220fe20ad027c52bda9ff829701b1657bc053a4e380ecff48d8d2700f6a30b0

SHA512
40c25b60285582459b1609ba3f5e9cbff7370557b0a9f5a9220ccd0be994330a586b1774c9fc59abd25af058e2f58248deaabc5b4432c16d283f8a8a263797ea

Download Submit
C:\RECYCLER\ow.exe

Filesize
27KB

MD5
eb33251c5bb482504bd24560d5277695

SHA1
b3aab57a661e23b67e9c663e240dd34643f7bd57

SHA256
5fb712bf3dbf2945f7b4a4e53648ccd12b7ec54258dd0c8c84c3400eeb282aae

SHA512
c43f280e3069505f63ab095c8699c776d9c581c5713a2aa8a65a3cbc372da7c9c9f9e2854206c697cd3f1b464143a3e74d8f2a0f5de94afd0f8d79905a822c1c

Download Submit
memory/2876-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2876-9-0x00000000002A0000-0x00000000002C5000-memory.dmp

Filesize
148KB

Download
memory/2876-15-0x00000000002A0000-0x00000000002C5000-memory.dmp

Filesize
148KB

Download
memory/2876-14-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2876-16-0x00000000002A0000-0x00000000002C5000-memory.dmp

Filesize
148KB

Download
memory/3032-13-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download